http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

中危 5.3CVE-2025-32997 · GHSA-9gqv-wp59-fq42 · Published 15/04/2025 · updated 17/06/2026

要点

CVE-2025-32997 是影响 http-proxy-middleware (chimurai), http-proxy-middleware 的中危 (CVSS 5.3)漏洞。
未来 30 天内被利用的概率（EPSS）：0.47%，高于 40.9% 的漏洞。
修复：升级到 3.0.5, 2.0.9 或更高版本。

Package	Affected versions	Patched versions
http-proxy-middleware chimurai	`≥ 3.0.0, < 3.0.5< 2.0.9`	`3.0.52.0.9`
http-proxy-middleware npm	`≥ 1.3.0, < 2.0.9≥ 3.0.0, < 3.0.5`	`2.0.93.0.5`

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.

NVD description

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≥ 3.0.0, < 3.0.5< 2.0.9

3.0.52.0.9

npm

≥ 1.3.0, < 2.0.9≥ 3.0.0, < 3.0.5

2.0.93.0.5

http-proxy-middleware 的其他漏洞

查看全部 →